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REMARKS 

The Examiner has objected to the specification, and rejected Claims 1-4, 6-12, 14- 
20, and 22-28 under 35 U.S.C, 1 12, first paragraph, as failing to comply with the written 
description requirement. Specifically, the Examiner has argued that "there is support for 
each of (i), (ii) and (iii) in the alternative, as shown in page 7 line 30 - page 8 line 1 5 of 
the present specification, but never as a combination" Applicant respectfully disagrees 
and points out that page 6, lines 12-13 of the specification states that "the anti-virus 
mechanism 6 can apply the techniques described hereinafter to resist mass mailing 
malware," and also notes that page 9, lines 21-22 of the specification states that "the 
general purpose computer 200 operating under control of a suitable computer program may 
perform the above described techniques" f emphasis added). Thus, support for the 
combination of (i) 5 (ii), and (iii) claimed in each of the independent claims is present 

Additionally, the Examiner has rejected Claims 1-3, 7, 9-11, 15, 17-19, and 23 
under 35 U.S.C. 103(a) as being unpatentable over Bates et al. (U.S. Patent No. 
6,779,021) in view of Marsh (U.S. Patent No. 6,763,462). Applicant respectfully 
disagrees with such rejection. 

In order to establish a prima facie case of obviousness, three basic criteria must be 
met. First, there must be some suggestion or motivation, either in the references 
themselves or in the knowledge generally available to one of ordinary skill in the art, to 
modify the reference or to combine reference teachings. Second, there must be a 
reasonable expectation of success. Finally, the prior art reference (or references when 
combined) must teach or suggest all the claim limitations. The teaching or suggestion to 
make the claimed combination and the reasonable expectation of success must both be 
found in the prior art and not based on applicant's disclosure. In re Vaeck>947 F.2d 488 4 
20 USPQ2d 1438 (Fed.Cir.1991), 

With respect to the first element of the prima facie case of obviousness and, in 
particular, the obviousness of combining the aforementioned references, the Examiner 
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has argued tliat it would have been obvious to combine Bates with Marsh because 4t the 
ordinary person skilled in the art would have been motivated to provide means of 
detecting viral spam as suggested by Marsh, as well as giving the user the final say in 
what is to be done with detected viral spam . . . [and that] in this combination it would be 
obvious that the messages would be held in a 'quarantine' for a predetermined amount of 
time prior to sending in order for the user to have the option of deleting the messages 
detected as being viral spam without sending the messages." To the contrary, applicant 
respectfully asserts that it would not have been obvious to combine the teachings of the 
Bates and Marsh references, especially in view of the vast evidence to the contrary. 

For example, the Bates reference teaches that "[i]n accordance with the present 
invention, multiple e-mails are received at a network server intended for multiple clients 
served by the network server" (see Abstract) and that "[b]lock 92 depicts a determination 
as to whether or 1C not the number of recipients of the new e-mail is greater that a 
designated 6 A' number of recipients... [where] a rule designating the C A' number of 
recipients is preferably included in spam filtering rules for the server" (see Bates Col. 8, 
lines 56-60), On the other hand, the Marsh reference teaches that "the virus detection 
utility 1 04 may be an add in program organized into a conventional format such as a 
plug-in for the e-mail application 102" where "[f]or example, the virus detection utility 
104 [is] stored as a dynamic link library (DLL) file and».include[sj routines to execute in 
conjunction with the e-mail application 102 to perform specific operations" (see Marsh 
Col. 2, lines 26-33). 

Clearly, in Marsh, the virus detection utility runs on clients in conjunction with 
email applications located on such clients, and utilizes client-based information (e.g. 
address books), whereas, in Bates, a server is used to receive emails sent to clients and to 
predict undesirable emails utilizing yules stored oi^ the seyvey. Thus, Marsh clearly 
teaches away from Bates. Applicant respectfully points out that it is improper to 
combine references where the references teach away from their combination. In re 
GrassellU 713 F,2d 732, 743, 218 USPQ 769, 779 (Fed, Circ, 1983). To this end, Marsh 
and Bates represent an ujjworkable combination since the client-based information, 
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namely address books of clients, as in Marsh, would not be available to the server in 
Bates for predicting undesirable emails, 

More importantly, with respect to the third element of the prima facie case of 
obviousness, and particularly with respect to the independent claims, the Examiner has 
relied on Col. 9, lines 3-19 from the Bates reference to make a prior art showing of 
applicant's claimed "comparison logic operable to compare said e-mail message with at 
least one of an address book of a sender of said e-mail message and one or more 
previously generated e-mail messages from said client computer" (see this or similar, but 
not necessarily identical language in the independent claims). 

Applicant respectfully notes that the excerpt from Bates relied on by the Examiner 
simply teaches "comparing the new e-mail source address with the source addresses of e- 
mail received during a designated 'B' time period" (emphasis added). Clearly, in Bates, 
a new e-mail source address is only compared with e-mail received, which does not meet 
"compare[ing] said e-mail message with at least one of an address book of a sender of 
said e-mail message and one or more previously generated e-mail messages from said 
client computer " where "said previously generated e-raail messages [are held] in a 
quarantine queue for at least a predetermined quarantine period prior to being sent from 
said client computer, " as specifically claimed by applicant (emphasis added). 

Additionally, with respect to the independent claims, the Examiner has relied on 
Col. 9, line 64 - CoL 10, line 10 from the Bates reference to make a prior art showing of 
applicant's claimed "identifying logic operable to identify whether... said e-mail message 
contains message content having at least a threshold level of similarity to non-identical 
message content of said previously generated e-mail messages being sent to more than a 
threshold number of addressees specified within said address book" (see this or similar, 
but not necessarily identical language in the independent claims). 

Applicant respectfully asserts the excerpt from Bates relied on by the Examiner 
merely discloses "comparing the content of e-mails that are the same size as the new e- 
mail with the content of the new e-mail" (emphasis added). However, applicant claims a 



PAGE 9111 ' RCVD AT 11/16/2006 4:12:33 PM [Eastern Standard Time] * SVR:USPT0-EFXRF-2/1 ' DNiS:2733300 < CS1D:40897U560 ■ DURATION (mm-ss):03<32 



NOV. 1 6. 2006 " 1:26PM Z I L K A-KOTAB, PC 



NO. 4813 P. 10/11 



4- 

technique where "said e-mail message contains message content having at least a 
threshold level of similarity to non-identical message content of said previously 
generated e-mail messages being sent to more than a threshold number of addressees 
specified within said address book" (emphasis added), in the context claimed. Applicant 
notes that simply nowhere in Bates is there any disclosure of "e-mail messages being sent 
to more than a threshold number of addressees specified within said address book. " in the 
context claimed by applicant (emphasis added). 

Additionally, applicant respectfully points out block 98 in Fig, 4A of the Bates 
reference, which "depicts a determination as to whether or not the number of users 
receiving e-mail from the same source address during the 6 B' time period is greater than a 
designated 'C number of recipients" (Col, 9, lines 9-12). In Fig. 4A, if the 
determination in block 98 results in an affirmative, or "YES," result, the process skips 
block 114, which "depicts a determination as to whether or not substantial similarities in 
content are found between the new e-mail and a particular amount of same sized e-mail" 
(Col. 10, lines 1-4), and instead proceeds directly to block 120, which "illustrates 
marking the new e-mail as predicted spam" (CoL 10, lines 17-18). Clearly, this fails to 
meet, and even teaches away from applicant's claimed "identifying logic operable to 
identify whether. ..s aid e-mail message contains message content having at least a 
threshold level of similarity to non-identical message content of said previously 
generated e-mail messages being sent to more than a threshold number of addressees 
specified within said address book/' as claimed (emphasis added). 

Applicant further notes that the prior art is also deficient with respect to the 
dependent claims. For example, with respect to Claim 25, as rejected under 35 U.S.C 
103(a) as being unpatentable over Bates, in view of Marsh, in further in view of Radatti 
et al. (U.S. Patent No. 6,763,467), the Examiner has relied on Col. 1, lines 36-48 of the 
Radatti reference, to make a prior art showing of applicant's claimed technique "wherein 
said e-mail message is identified as potentially containing malware only if said e-mail 
message includes an executable element, to speed processing." Specifically, the 
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Examiner has argued that "Radatti teaches that only executable code may contain 
malware." 

Applicant respectfully points out that the exceipt from Radatti merely discloses 
that *'[a]ll binary executables, unreviewed shell scripts, and source code accessed from an 
external network may contain worms, vituses, or trojan horses" and that " outside binary 
executables, shell scripts, and scanned source code mav enter an internal ne twork or 
single computer system through an E-mail attachment" (emphasis added). However, 
simply disclosing that executables may contain worms, viruses, or Trojan horses, as in 
Radatti, does not specifically teach any sort of e-mail, let alone meet applicant's 
specifically claimed technique c *wherein said e-mail message is identified as potentially 
containing malware only if said e-mail message includes an executable element, to speed 
processing. " as claimed by applicant (emphasis added). 

In addition, with respect to Claim 26, the Examiner has relied on Col, 1, line 66- 
Col. 2, lines 7 in Bates to make a prior art showing of applicant's claimed technique 
5t wherein said e-mail message is identified as potentially containing malware when said 
e-mail message and said previously generated e-mail messages share a common 
attachment" Applicant respectfully asserts that such excerpt from Bates only discloses 
that "other destructive attachments . . . can easily be transmitted within a server upon 
activation of a single client within a network." Clearly, only mentioning an attachment, 
as in Bates, does not even suggest applicant's specific claim language, namely that "said 
e-mail message is identified as potentially containing malware when said e-mail message 
and said previously generated e-mail messages share a common attachment " as claimed 
(emphasis added). 

Thus, at least the first and third elements of the prima facie case of obviousness 
have not been met, since the combination of the prior art references is improper, and 
since the prior art references, when combined, fail to teach or suggest all of the claim 
limitations, as noted above. 
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